diff --git a/.github/workflows/self-test.yml b/.github/workflows/self-test.yml
new file mode 100644
index 0000000..6128ab6
--- /dev/null
+++ b/.github/workflows/self-test.yml
@@ -0,0 +1,12 @@
+name: Self Test
+on:
+  pull_request: {}
+  push:
+    branches: [ master ]
+jobs:
+  security:
+    uses: ./.github/workflows/security.yml
+    # no inputs: exercises defaults. This repo has no src/ or bin/, so
+    # clj-kondo and shellcheck must SKIP gracefully (portability guard test);
+    # gitleaks / clj-holmes / semgrep run against the repo tree.
+    secrets: inherit